💡 Post-Clinejection AI Agent Input Quarantine & CI Metadata Firewall Standard

[github-actions[bot]]

Summary

Mandate a deterministic input quarantine layer for all AI agent workflows that process GitHub metadata (issue titles, PR descriptions, comments, labels). Inspired by the Clinejection supply chain attack (February 2026) where a malicious issue title triggered prompt injection leading to cache poisoning, credential theft, and unauthorized npm publish affecting ~4,000 developer machines.

Market Signal

The Clinejection attack (February 2026) proved that AI agents processing untrusted GitHub metadata in CI/CD can be weaponized for supply chain compromise:

• A malicious GitHub issue title injected instructions into the Cline project's AI issue triage bot
• The bot, running in a CI pipeline with elevated credentials, was tricked into poisoning the Actions cache and exfiltrating publication credentials
• An unauthorized npm package version was published, installing a covert AI agent (OpenClaw) on ~4,000 developer machines over 8 hours
• The Cloud Security Alliance published a formal research note; Aikido Security identified similar vulnerable patterns at five Fortune 500 companies

The GitInject paper (June 2026, arXiv:2606.09935) systematically analyzed prompt injection via tool-poisoning across seven MCP clients, finding significant security disparities. The era of AI-installing-AI supply chain attacks has arrived.

Sources: CSA Clinejection research note, Snyk Clinejection analysis, GitInject paper

User Signal

The org runs multiple AI agents in CI that process untrusted GitHub metadata:

• dev-lead: Processes issue titles and bodies to determine work items
• pr-review: Processes PR titles, descriptions, and diff content
• feature-ideation: Processes issue titles, feature requests, and discussion content
• compliance-audit: Processes issue and PR metadata for compliance checks

Agent-shield guards the output side (what agents write). The input side — where metadata enters the LLM context — has no equivalent deterministic guard. The agent-rate-limits standard and agent-shield show the org is serious about agent governance; input quarantine is the missing complementary layer.

Technical Opportunity

The org's "decision logic in a pure tested script" pattern (AGENTS.md) is ideal for this:

• A quarantine script (scripts/lib/agent-input-quarantine.sh) can be source'd before any LLM call
• It strips control characters, detects known prompt injection patterns (instruction override attempts, role reassignment, base64-encoded payloads), and validates metadata format
• Runs deterministically — zero LLM cost, unit-testable with bats
• The existing agent-shield deployment pattern (reusable workflow + CI gate) provides the rollout model
• Defense in depth: input quarantine (pre-LLM) + permission scoping (during) + agent-shield (post-LLM)

Assessment

Dimension	Score	Rationale
Feasibility	high	Deterministic shell script, fits existing patterns, no new infrastructure
Impact	high	Protects every CI agent from the #1 emerging attack vector in the agentic CI space
Urgency	high	Clinejection was February 2026; similar attacks at Fortune 500s identified; the window is open

Adversarial Review

Strongest objection: Deterministic pattern matching for prompt injection is an arms race — attackers will find bypasses. The real defense is limiting agent permissions (least privilege) so even a successful injection cannot cause damage. Input filtering gives false confidence.

Rebuttal: Defense in depth requires both layers. Least privilege limits the blast radius (the org already does this via GITHUB_TOKEN scoping and the agent-rate-limits standard). Input quarantine raises the bar for exploitation — Clinejection succeeded partly because zero input validation existed. The standard does not claim to be a complete defense; it is one layer in a stack that includes agent-shield (output monitoring), permission scoping (blast radius), and the rate-limit gate (cost containment). A 50% reduction in injection success rate from a deterministic filter is still a 50% reduction — and it costs nothing at runtime.

Suggested Next Step

Catalog all org AI agent workflows that consume GitHub metadata, document the specific metadata fields each processes, and draft the quarantine script with test cases derived from the Clinejection attack pattern (issue title injection, cache poisoning vector) and the GitInject paper's MCP tool-poisoning taxonomy.